Binance counted 57 suspected North Korea-linked threats detected and prevented in 2026, and its separate preliminary findings tied a fake job interview to an October breach affecting about $6.34 billion in virtual assets.
Binance has not disclosed whether any of those threats were tied to the engineer’s compromised work computer or how many involved fake interviews.
In its Nov. 3 update, Binance valued funds frozen or intercepted at $2.85 billion and put replenishment of affected token assets at 98%. The exchange said reconciliation was still underway, so the figure did not establish a final net loss.
Binance said the sequence began in September, when an engineer seeking a job with a fictitious company received a coding task. Setting it up infected the engineer’s work computer, the exchange said. On Oct. 20, attackers used that machine and an internal AI tool to gain access to two colleagues’ computers.
Binance said attackers used stolen credentials and a container deployment token on Oct. 29 to enter wallet-signing systems, evading the exchange’s usual withdrawal process. EconoTimes previously covered Binance’s estimate of the assets affected by the breach.
Binance said its investigation is continuing, with an independent review planned.
